MALPEDIA_Win_Cobalt_Strike_Auto

rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0368001f-2097-5ad0-a8cc-9f3157226350"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.cobalt_strike_auto.yar#L1-L294"
		license_url = "N/A"
		logic_hash = "31216c950a7137c94bf3f4288b8613a4e99b697ec3135af46a44daf232429edc"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e9???????? eb0a b801000000 e9???????? }
		$sequence_1 = { 3bc7 750d ff15???????? 3d33270000 }
		$sequence_2 = { e8???????? 83c40c eb13 6a02 56 6a01 6820bf0200 }
		$sequence_3 = { ff15???????? 85c0 741d ff15???????? 85c0 7513 }
		$sequence_4 = { eb25 53 8d45fc 50 53 }
		$sequence_5 = { eb09 8b45f8 83c001 8945f8 8b4514 }
		$sequence_6 = { ff15???????? 59 85c0 7510 83c604 }
		$sequence_7 = { ff5510 83c40c ebd6 55 }
		$sequence_8 = { ff5510 57 e8???????? 83c434 8b750c }
		$sequence_9 = { 85c0 7405 e8???????? 8b0d???????? 85c9 }
		$sequence_10 = { e9???????? 833d????????01 7505 e8???????? }
		$sequence_11 = { 8bd0 e8???????? 85c0 7e0e }
		$sequence_12 = { 7cec 488b4d1f 8bd3 3b1e 7d13 }
		$sequence_13 = { 498b4610 8bcb 41b801000000 2bf3 }
		$sequence_14 = { eb0b 8b4328 c644182c00 ff4328 837b2838 72ef 8a4307 }
		$sequence_15 = { eb0b b810000000 eb09 418d4102 418900 33c0 4883c420 }
		$sequence_16 = { 2500800000 7409 c745f040000000 eb07 c745f004000000 }
		$sequence_17 = { 50 6a20 8b4d10 51 8b550c 52 8b4508 }
		$sequence_18 = { 837d0c00 7422 837d1000 761c 837d1404 }
		$sequence_19 = { 8b5514 52 8b450c 8b4850 }
		$sequence_20 = { 52 8b4508 8b08 ffd1 85c0 }
		$sequence_21 = { 32c0 b940000000 f3aa 5f 5e 8be5 }
		$sequence_22 = { 8b4510 8b4850 8b550c 8d440ac0 }
		$sequence_23 = { 56 57 8b4510 8b4850 }
		$sequence_24 = { 488b542408 0fb70402 03c1 b9ff0f0000 488b1424 0fb712 }
		$sequence_25 = { 486bc005 488b4c2448 488d840188000000 4889442418 488b442418 83780400 }
		$sequence_26 = { 488bc1 4889442408 488b442408 c70000000000 }
		$sequence_27 = { 4889442428 488b442418 48ffc8 4889442418 48837c242800 0f8496010000 488b0424 }
		$sequence_28 = { 4889542410 48894c2408 4883ec38 488b442448 488b4030 }
		$sequence_29 = { 488bc1 4889442428 488b442428 813850450000 7502 }
		$sequence_30 = { 3d00000020 7518 488b442468 488b4c2410 488908 }
		$sequence_31 = { c644242f32 c644243000 c64424384c c64424396f c644243a61 }

	condition:
		7 of them and filesize < 1015808
}